At UBDS, we help organisations transform through cloud, cyber security, AI and digital innovation. As our Managed Services capability continues to grow, we're looking for an experienced Cyber Incident Response Consultant to join our Security and Infrastructure Operations Centre (SIOC), based in either London or Manchester.
This is a hands-on, customer-facing consultancy role focused on investigating, responding to and recovering from cyber security incidents across complex customer environments. You will support and lead incident response engagements, conduct digital forensic investigations and advise customers on strengthening their cyber resilience and incident response capabilities.
You will work primarily across Microsoft and AWS environments, alongside SIEM, EDR and digital forensic tooling.
What You'll Do
• Lead or support customer-facing cyber incident response engagements, from initial investigation through containment, eradication, recovery and reporting.
• Investigate security incidents including ransomware, malware, phishing, account compromise and unauthorised access.
• Conduct digital forensic investigations across endpoints, servers, cloud environments and network infrastructure.
• Analyse security logs, endpoint telemetry, forensic artefacts and indicators of compromise to establish incident scope and root cause.
• Use EDR, SIEM and forensic tooling to investigate suspicious activity and reconstruct attack timelines.
• Advise customers on containment decisions, remediation priorities and recovery approaches.
• Support eradication and recovery activities, validating remediation and identifying any remaining security risks.
• Collect, preserve and document digital evidence, following appropriate forensic procedures and chain-of-custody requirements.
• Produce professional incident investigation reports, including findings, timelines, root cause and remediation recommendations.
• Present investigation findings and recommendations to technical teams, customers and senior stakeholders.
• Support threat hunting, detection engineering and improvements to security monitoring capabilities.
• Develop and improve incident response playbooks, processes and procedures.
• Design and support cyber incident exercises, including tabletop scenarios, simulated incidents and response workshops.
• Facilitate or contribute to exercises, evaluating response effectiveness and producing post-exercise recommendations.
• Work closely with SIOC analysts, security engineers, cloud specialists and wider Managed Services colleagues during incidents.
• Provide technical guidance and mentoring to less experienced security professionals.
What We're Looking For
We're looking for someone with strong incident response experience, practical forensic investigation skills and the confidence to engage directly with customers.
• Experience working within Cyber Incident Response, DFIR, SOC/SIOC or a similar cyber security environment.
• Hands-on experience investigating and responding to cyber security incidents.
• Experience supporting or leading customer-facing incident response engagements.
• Strong experience with EDR tooling, SIEM platforms and security log analysis.
• Understanding of incident response processes, including containment, eradication, recovery and lessons learned.
• Practical knowledge of digital forensic techniques, including endpoint, memory, network or cloud forensics.
• Experience collecting and preserving digital evidence, with an understanding of chain-of-custody principles.
• Ability to analyse attacker activity, indicators of compromise and common attack techniques.
• Good understanding of Windows, Linux, networking and cloud security.
• Experience investigating security incidents within Microsoft and/or AWS environments.
• Experience producing technical investigation reports and presenting findings to customers.
• Strong analytical, investigative and problem-solving skills.
• Excellent communication, stakeholder engagement and consultancy skills.
Desirable Experience
Experience across some of the following would be beneficial:
• Microsoft Defender XDR, Defender for Endpoint and Microsoft Sentinel.
• AWS security services, logging and incident investigation.
• Digital forensic tooling such as Velociraptor, KAPE, Autopsy, Volatility or equivalent.
• Malware analysis, reverse engineering or network forensics.
• Threat intelligence, threat hunting and MITRE ATT&CK.
• Experience supporting ransomware investigations and complex security incidents.
• Designing and facilitating cyber incident tabletop exercises.
• Developing realistic incident scenarios, injects and exercise objectives.
• Evaluating exercise performance and producing post-exercise reports and recommendations.
• Red Team, penetration testing or adversary simulation experience.
• Python, PowerShell or scripting for investigation and automation.
• Experience delivering cyber security consultancy services to external customers.
• Experience working within Government, Defence or other regulated environments.
Desirable Qualifications
Relevant certifications or equivalent practical experience would be beneficial, including:
• CREST Registered Incident Analyst (CRIA) or equivalent.
• GIAC Certified Incident Handler (GCIH).
• GIAC Certified Forensic Analyst (GCFA).
• GIAC Certified Forensic Examiner (GCFE).
• Microsoft Security Operations Analyst Associate (SC-200).
• CompTIA CySA+, Security+ or equivalent.
• Relevant SANS, CREST or other DFIR training.
The Opportunity
Based in London or Manchester, you'll join our growing Managed Services capability, working alongside experienced cyber security, cloud and infrastructure professionals within our SIOC.
You'll gain exposure to a broad range of customer environments, complex cyber investigations and digital forensic activities, while playing an important role in helping customers respond to and recover from security incidents.
You'll also have the opportunity to help develop UBDS's DFI